SurinameDraft Law on the Protection of Privacy and Personal Data, cross border transfer
Art. 22 Wet Bescherming Privacy en Persoonsgegevens
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a recipient in a third country unless the recipient is subject to a law, binding corporate rules, or a binding agreement providing a level of protection substantially comparable to this law's processing principles and its own transfer rules, unless an article 6 lawful basis applies or the Commissioner for Personal Data Protection has authorised that specific transfer.
- Transfer special categories of personal data or criminal conviction or offence data to a third country only where the recipient is bound by an adequate protection instrument or the Commissioner has authorised the specific transfer, not merely on an article 6 lawful basis.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 22 bars a transfer to a recipient in a third country unless the recipient is bound by a law, binding corporate rules or a binding agreement giving an adequate level of protection, an article 6 lawful basis applies, or the Commissioner has authorised the specific transfer; article 22(2) narrows the route for special-category and criminal-conviction data. It requires no record of a transfer and no production of one. The register of processing activities that states third-country recipients and the legal basis for each transfer is article 18, which sits on the general row. The text is a draft bill.
- Kind
- None
- As of
What this law does
Article 22(1) bars a controller or processor from transferring personal data to a recipient in a third country unless the recipient is subject to a law, binding corporate rules, or a binding agreement that offers a level of protection substantially comparable to this law's own processing principles and its rules on onward transfer, or one of the article 6 lawful bases for processing applies, or the Commissioner for Personal Data Protection has authorised that specific transfer.
Article 22(2) narrows that further for special categories of personal data and criminal conviction or offence data, which may only be transferred where the recipient is bound by such an adequate protection instrument or the Commissioner has specifically authorised the transfer, not merely on an article 6 lawful basis.
Article 22(3) lets the Commissioner identify, in accordance with article 31(1)(j), which laws, binding corporate rules or binding agreements offer an adequate level of protection under article 22(1)(a). The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .